Mechanism notes.

1 Scope · 2 Invariants · 4 Discovery · 5 Addressing · 8 Election · 9 Memory · 11 Wire · 12 Security · 16 Conformance · 17 Limits

Four terms.

Each names a different layer.

FrogNet

The network: discovery, election, routing, overlay, healing. A property of the fabric.

FrogNet Memory

The addressable store the fabric carries. One per connected pond, held by the elected database host.

UnREST

The programming model. Write where you compute, read where you need. A property of the application, not the wire.

FNWP-1 / BLDC-1

The binary framing and the semantic codec. What actually crosses, and how little of it there is.

The exchange, in four moves.

1 — learn

First contact for a request class carries the full payload. Both ends derive a template separating fixed structure from varying fields. Nothing is cached yet, by definition, so this exchange cannot be small.

2 — name

The template is identified by a 16-byte hash of the request. Subsequent exchanges reference it rather than restating it.

3 — diff

Changed fields are sent by index against the last successfully exchanged reference. Unchanged fields are absent, not compressed.

4 — re-execute

On a repeat the far end runs the request against the real origin, compares the result to what it last returned, and answers SAME only on genuine identity. This is not a cache. A cache returns what it stored; this returns what the origin says now, and reports that it is unchanged.

Two suppression mechanisms.

They are distinct and keyed differently.

link

Between two endpoints of one exchange, the wire carries the difference. This is BLDC-1 and it is what produces the 21-byte floor.

origin

Coalescing at the daemon: concurrent identical requests execute once against the origin and the single result fans out. This is why the ratio rises with concurrency while the per-request cost stays flat.

The measured evidence for the second is that per-request cost is identical at 25 serial and 269 concurrent. If coalescing were doing the compression work, that figure would move.

The programming-surface claim, stated testably.

Prior surface raises — assembly to C, manual memory to managed, threads to structured concurrency — removed a category of code from the application. Distributed applications still contain their communication: endpoints, retries, ordering, schema versions, and a list of consumers to notify.

The test is mechanical: take a system you maintain and count what remains if none of the message-handling code has to exist.

The simulator runs the real discovery, routing and election code against a modelled topology; this is possible because none of that code identifies the source of a value.

Trust boundaries.

cryptography

None of FrogNet’s own. WireGuard, TLS, OpenSSL, and HMAC-SHA256 for authentication and integrity. Confidentiality on the public internet is the WireGuard bearer’s.

the broker

Carries the inter-site data path; holds no node identity and no pond secret; runs no part of the semantic stack; forwards in the kernel; is not a member of any pond it serves. The threat model assumes broker compromise; owning the transit point yields the transit point.

the public tier

Where something must accept input from the open internet, it writes one file into a watched directory and does nothing else. No credential, no socket, no execution. The inside pulls; nothing outside reaches in.

capture, not publication

Fabric traffic is captured on the node and served internally rather than published. What is reachable from outside is the broker address you chose.

what remains

Host access, wireless admission, WireGuard credentials, a taken node, the broker, local privilege boundaries, supply chain, and bugs in FrogNet.

The specification → The build manual → The simulator →